An incident response technician collected a mobile device during an investigation. Which of the following should
the technician do to maintain chain of custody?


A. Document the collection and require a sign-off when possession changes.
B. Lock the device in a safe or other secure location to prevent theft or alteration.
C. Place the device in a Faraday cage to prevent corruption of the data.
D. Record the collection in a blockchain-protected public ledger.